Fallos del tipo CWE-617

558 resultados

Asserção acessível por entrada não confiável

Código de produção contém asserções (assert statements) que podem ser disparadas por dados fornecidos pelo usuário ou atacante, causando falha abrupta da aplicação. Diferente de validação, asserções são mecanismos de debug que não deveriam controlar o fluxo normal — quando acionadas, encerram o programa, provocando negação de serviço.

Ejemplo

Um servidor web recebe um parâmetro `user_id` e executa `assert user_id > 0` antes de consultar o banco. Um atacante envia `user_id=0` ou negativo, a asserção falha e derruba o servidor. O código assume que validação já ocorreu, mas ela não existe.

Cómo mitigar

Substitua asserções por validação explícita com tratamento de erro apropriado (throw exception, retornar código de erro). Remova ou desative asserções em builds de produção. Use asserções apenas para condições internas que nunca deveriam ocorrer, nunca para entrada de usuário.

CVE-2025-48019MEDIUMA vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected product receives maliciouEPSS 0.2%CVE-2025-8836MEDIUMJasPer JPEG2000 Encoder jpc_enc.c jpc_floorlog2 assertionEPSS 0.2%CVE-2025-8698MEDIUMOpen5GS AMF Service nsmf-handler.c amf_nsmf_pdusession_handle_release_sm_context assertionEPSS 0.2%CVE-2025-9403MEDIUMjqlang jq JSON jq_test.c run_jq_tests assertionEPSS 0.2%CVE-2024-34036MEDIUMAn issue was discovered in O-RAN Near Realtime RIC I-Release. To exploit this vulnerability, an attacker can disrupt the initial connection EPSS 0.2%CVE-2023-29935MEDIUMllvm-project commit a0138390 was discovered to contain an assertion failure at !replacements.count(op) && "operation was already replaced.EPSS 0.2%CVE-2026-76926LOWReachable Assertion in WiresharkEPSS 0.2%CVE-2025-31160LOWatop through 2.11.0 allows local users to cause a denial of service (e.g., assertion failure and application exit) or possibly have unspecifEPSS 0.2%CVE-2024-20147MEDIUMIn Bluetooth FW, there is a possible reachable assertion due to improper exception handling. This could lead to remote denial of service witEPSS 0.2%CVE-2026-119132MEDIUMWasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused AdapterEPSS 0.2%CVE-2026-5170MEDIUMUsers could trigger a crash of mongod primaries during promotion to shardedEPSS 0.2%CVE-2026-119139MEDIUMWasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::callEPSS 0.2%CVE-2026-119135MEDIUMWasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type MismatchEPSS 0.2%CVE-2026-34933MEDIUMAvahi: Reachable assertion in `transport_flags_from_domain()` via conflicting publish flags crashes avahi-daemonEPSS 0.2%CVE-2026-20525MEDIUMIn Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connecEPSS 0.2%CVE-2024-56783MEDIUMnetfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup levelEPSS 0.2%CVE-2026-20600MEDIUMIn Modem, there is a possible application crash due to a logic error. This could lead to remote denial of service, if a UE has connected to EPSS 0.2%CVE-2026-8852MEDIUMIBM HTTP Server is affected by multiple vulnerabilitiesEPSS 0.2%CVE-2023-36840MEDIUMJunos OS and Junos OS Evolved: An rpd crash occurs when a specific L2VPN command is runEPSS 0.2%CVE-2026-20593MEDIUMIn Modem, there is a possible application crash due to improper input validation. This could lead to remote denial of service, if a UE has cEPSS 0.2%